云安全机制.pptVIP

§10.7 基于云的安全组 云资源分割(segmentation) 为不同用户和组创建各自的物理和虚拟IT环境的过程。 云资源分割是虚拟化的基础 基于云的安全组(cloud-based security group) 基于云的资源分割，网络被分成逻辑的基于云的安全组，形成逻辑网络边界。 基于云的安全组 运行在同一个物理服务器上的多个虚拟服务器逻辑上可以是不同基于云的安全组的成员。 基于云的安全组能限制对资源的未被授权的访问。 用来对抗 拒绝服务、授权不足和信任边界重叠等威胁 图10.11 Figure 10.11 - A logical cloud-based security group, Group A, is comprised of Virtual Servers A and D and assigned to Cloud Consumer A, while Group B is comprised of Virtual Servers B, C, and E and assigned to Cloud Consumer B. If Cloud Service Consumer As user account is compromised, the attacker would only be able to damage the server